Two QFT Records in Four Months. Neither Gets You Closer to Breaking RSA.

Paul Coote, Michael Biercuk, and Yuval Baum of Q-CTRL posted a preprint today reporting a quantum Fourier transform executed across 100 qubits on an IBM Heron r3 processor. It is a genuine compilation result with real engineering value, and I will spend a section of this article explaining why. It is also, by tomorrow morning, going to produce a wave of headlines connecting a 100-qubit QFT to Shor’s algorithm and the security of RSA. I know this because it already happened once this year.

On April 16, phys.org ran a story titled “Quantum Fourier transform reaches 52 qubits, shattering the previous 27-qubit record.” The University of Innsbruck announcement behind it presented the QFT as a foundational piece of algorithms used in cryptography, financial modeling, and materials science, with ParityQC’s co-CEOs quoted on European quantum work taking a global lead. Q-CTRL just doubled the qubit count. The coverage cycle will repeat, and I would rather publish the correction before the error.

Here is my summary: QFT width on physical qubits is not a proxy for cryptanalytic capability, and neither of these records materially moves Q-Day, because in every leading fault-tolerant RSA-2048 design the dominant costs are modular arithmetic, non-Clifford resource production, error correction, decoding, and sustained runtime. The terminal Fourier transform is not a principal cost driver.

That is not an attack on either team. Both papers are careful, both contain real results, and Q-CTRL’s compilation work in particular is the most interesting thing I have read on QFT synthesis in a while. The trouble starts downstream, when someone writes “the transform at the heart of the algorithm that breaks RSA now runs on 100 qubits” and a board somewhere reads it over coffee.

So seeing what happened in the media after the previous QFT record announcement, I decided to publish the explainer before the noise.

The compilation result is the good part

Strip away the 100-qubit headline and Q-CTRL’s paper contains a clean piece of circuit theory.

Compiling any algorithm onto hardware with limited connectivity costs you gates. When two qubits that need to interact are not physically adjacent, you route quantum information across the chip with extra entangling operations, and every one of those operations is a chance to fail. The linear nearest neighbor topology, where each qubit talks only to the two beside it, is the sparsest connectivity worth optimizing for, and it is also the most portable target: any device with a long enough path through its coupling graph can host an LNN circuit. Both teams did exactly that on ibm_boston, laying their circuits along a linear subgraph of a heavy-hex lattice.

Coote and colleagues derive an LNN compilation of the n-qubit QFT that needs $$n^2 – n$$ CX gates. That is the same count you get from direct synthesis on an idealized all-to-all machine where every qubit can reach every other qubit at no cost. The routing penalty in CX count is not reduced. It is gone.

The improvement comes from three circuit identities applied in sequence: rewriting each Hadamard as $$S \cdot \sqrt{X} \cdot S$$ (up to a global phase), pushing the phase gates to the circuit boundaries where they commute through the diagonal controlled-phase layers, and then sliding each $$\sqrt{X}$$ leftward through a particular arrangement of three CX gates. At every interface between adjacent QFT layers, two CX gates that were previously separated by a Hadamard become adjacent and cancel. Across $$n-2$$ interfaces, that saves $$2n-4$$ gates over the Park and Ahn construction it builds on.

The convolutional variant adds one ancilla and two CX gates to buy something subtler. In the base circuit, an initial chain of $$n-1$$ CX gates sits causally upstream of every other operation, so noise from that chain contaminates everything downstream. Adding an ancilla in the $$|0\rangle$$ state and a chain of SWAPs reverses the direction of that chain, which lets the compiler schedule it much later. The circuit then reduces to a translation-invariant kernel spanning $$d+2$$ qubits that steps along the register one position at a time. The kernel does not perform a small QFT on any subset; the full transform emerges from the whole convolution.

Payoff: in the paper’s worked ten-qubit example the topmost qubit wire carries 14 CX gates in its causal history under the base layout, and nine under the convolutional one. Qubits spend most of the circuit idle and protected by uninterrupted dynamical decoupling rather than being dragged through routing operations.

This part survives peer review or it does not, but it is mathematics, not a demo. And it applies beyond noisy hardware: the authors point out that grids of adjacent surface-code patches in a fault-tolerant machine face the same locality constraint. ParityQC’s team makes the same point about lattice surgery at the end of their own paper. Both groups are right about that.

Two records, four months apart, measured differently

Now the part nobody has written up, and the reason I nearly got this wrong myself.

ParityQC’s paper, from Philipp Aumann, Michael Fellner, Wolfgang Lechner and colleagues, ran on ibm_boston, an IBM Heron r3 device. Q-CTRL ran on an IBM Heron r3 device. Same backend, same family of process-fidelity estimator, claims published four months apart. It looks like a controlled comparison.

It is not, and the list of differences is longer than the shared backend is reassuring.

ParityQC executed the unitary QFT, the full transform with every controlled-phase angle intact, using 20 input states and 2,000 shots per circuit. Q-CTRL ran an approximate QFT, using 20 input states and 4,096 shots. Their truncation is more careful than “drop the small rotations”: they decompose each controlled-phase gate into an entangling $$R_{ZZ}$$ term plus two local phase terms, discard only the entangling component at $$\pi/16$$ and below, and absorb the single-qubit phases into RZ gates at the circuit boundaries at zero CX cost. Since the QFT’s angles run $$\theta_k = \pi/2^k$$, that leaves exactly three entangling angles, an AQFT at $$d=3$$, across a register of up to 100 qubits. Approximating the QFT is a legitimate and old technique, going back to Coppersmith’s 1994 IBM report (posted to arXiv in 2002), and Q-CTRL states the truncation plainly in their experimental section. But it changes the circuit by nearly an order of magnitude, and the abstract’s claim about the largest experimental QFT does not carry the qualifier.

The post-processing differs too, in both directions. Q-CTRL’s headline 11.4% at 50 qubits is measured after readout-error mitigation; their raw figure for the composite QFT-plus-measurement operation is 9.6%. ParityQC’s roughly $$10^{-2}$$ at $$N=50$$ comes from dynamical decoupling and transpiler layout selection with no readout mitigation reported, which makes it the analog of Q-CTRL’s 9.6%, not the 11.4%. Meanwhile ParityQC’s actual 52-qubit claim is not a fidelity result at all. It comes from plurality voting across 21 equivalent circuit variants at 10 input states and 1,000 shots each, and the authors are careful to say that plurality-voted success rates should not be set beside process fidelities. Q-CTRL applied no plurality voting, which on that axis makes them the more conservative of the two.

Neither paper reports execution dates, calibration windows, or fixed physical layouts shared between them, so even the common backend does not make these matched runs. One team ran a full transform and reported two different numbers under two different protocols. The other ran a heavily truncated transform under a third. Two records. Two definitions.

Count the gates, then count the depth

Both constructions have published closed-form CX counts, conveniently tabulated side by side in Q-CTRL’s Table I. (ParityQC’s own paper gives only leading-order scaling; the exact $$n^2-1$$ figure for the linear Parity Twine network comes from Klaver and colleagues, the same group’s method paper.) So this part is arithmetic rather than argument.

At 50 qubits, the linear Parity Twine network needs $$n^2 – 1 = 2{,}499$$ CX gates. Q-CTRL’s convolutional AQFT at $$d=3$$ needs $$d(2n – d – 1) + 2 = 290$$.

That is an 8.6-fold reduction in entangling operations against the circuit it is implicitly being compared with. Almost all of it comes from truncation rather than from the compilation advance: Q-CTRL’s own full QFT construction would need 2,452 CX gates at 50 qubits, within 2% of ParityQC’s count and within two gates of the all-to-all baseline. Of the 2,209-gate gap between the two headline experiments, 2,162 gates, or 98%, come from choosing $$d=3$$. What Q-CTRL’s compiler contributes is realizing that sparse interaction pattern on a linear chain at essentially no extra CX cost, which the Parity Twine construction does not do, since its count stays at $$n^2-1$$ whether or not you approximate.

At 100 qubits the same $$d=3$$ AQFT costs 590 CX gates. A full QFT at that width would cost 9,902. Whatever “a QFT on 100 qubits” conjures, the circuit that ran carries about 6% of the entangling operations the phrase implies.

Gate count is only half the story, though, and the other half runs the other way. Take the CX-depth column of the same table. At 50 qubits, ParityQC’s full-QFT construction has depth 196, close to the all-to-all baseline of 194 and linear in n. Q-CTRL’s full-QFT LNN construction has depth 2,342, which is quadratic. Their convolutional AQFT at $$d=3$$ has depth 196, identical to Parity Twine’s full transform, because at $$d=3$$ the formula reduces to the same $$4n-4$$. So the circuit Q-CTRL actually executed is excellent on both count and depth. The full-transform construction that matches ParityQC’s gate count does not match its depth, and Q-CTRL never ran it on hardware. Any comparison of the two compilers has to say which column it is talking about.

What the benchmark measures

Both teams use the same benchmarking protocol, from Lubinski and colleagues at the QED-C, and both take their unbiased process-fidelity estimator from the same source: Bäumer, Tripathi, Seif, Lidar and Wang. Hold onto that, because it matters at the end.

The protocol prepares, using only single-qubit gates, a separable state whose QFT is a known computational basis state. In Q-CTRL’s case that means a layer of Hadamards followed by RZ rotations parameterized by a randomly chosen target frequency. The circuit then applies the QFT, which should map that state onto the basis state, and you estimate the probability assigned to that exact target across a sample of chosen frequencies.

As a fidelity benchmark this is excellent, which is exactly what it was designed for. The ideal output is a single known bitstring, so success probability is directly observable and the estimator is unbiased.

As a computation it is empty. The input is a classically specified product state described by 100 angles. The output is an integer chosen before the experiment began. The circuit does perform the transform, and does it across a large register, but it does not search a space of $$2^{100}$$ candidates, because the answer was written into the input and can be read off the preparation parameters with a few lines of arithmetic.

Which is why one line in Q-CTRL’s conclusion goes further than the evidence supports. The paper notes that the transform operates on a $$2^{100}$$-element signal space far exceeding any classical Fourier transform implementation. Formally the Hilbert space has that dimension. But the state occupying it belongs to a classically specified family with a predetermined ideal output, and evaluating this particular instance classically is trivial. Paul Coote’s LinkedIn framing has the same shape, describing more than a quadrillion quadrillion wrong answers against one correct frequency the QFT must find. Nothing was found. The frequency was encoded, transformed, and read back.

To be fair to Coote, his post is otherwise accurate, including the description of QFT as underpinning phase estimation and factoring. The overreach is one sentence in a careful piece of work. But it is the sentence that will get quoted.

The 100-qubit number needs an asterisk

Q-CTRL reports 11.4% process fidelity at 50 qubits and 1.8% at 80. Past 80 qubits, fidelity drops below the conventional 1% threshold used in the benchmarking literature, and the paper says so.

What remains at 100 qubits is a narrower claim: the correct bitstring is still the most frequently observed outcome. Reading their Figure 4 against the log gridlines, target probability at that width sits around $$1 \times 10^{-3}$$ and the most likely wrong answer around $$7 \times 10^{-4}$$. At 4,096 shots per circuit, that is roughly four counts on the target against roughly three on its nearest rival. The claim is true. It is also resting on a difference of about one count.

Note also what is reported and what is not. In the raw unmitigated data, the target appears 8.4 times more often than any single incorrect output at 50 qubits, and 7.5 times at 80. At 100 qubits, the width in the title, no ratio is given and no uncertainty interval is offered, only that the target remains the mode. The paper says the gap closes as $$n \to 100$$, which is honest. It also means the headline number rests on the weakest data in the paper. (There is also an ancilla: the convolutional construction needs 101 physical qubits to do a 100-qubit QFT, and the authors state that they do not count it toward the size of the demonstration. Defensible. Also convenient.)

Both are company-led preprints, which is worth saying plainly. Biercuk is Q-CTRL’s CEO and the results validate Q-CTRL’s own error-suppression pipeline. Lechner is ParityQC’s co-CEO, alongside a University of Innsbruck affiliation, and the results validate a compiler the paper says is being prepared for wider release. Neither team hides this. Q-CTRL’s data is available on request rather than deposited, which for a benchmarking claim is the weaker option. ParityQC ran a fixed-layout control in an appendix, which is the better practice of the two, and has committed a CC BY license to any accepted manuscript arising from the submission, though the preprint itself carries the standard arXiv license.

Shor’s algorithm barely uses this part

Now the question that matters to anyone tracking CRQC timelines.

The intuition that a bigger QFT means a closer RSA break assumes the QFT is the expensive part of factoring. It is not, and it has not been since 1996. Griffiths and Niu showed that when the Fourier transform is immediately followed by measurement, its two-qubit gates can be replaced by sequential measurements and classically controlled single-qubit operations; iterative phase-estimation constructions built on that principle can also recycle the control qubit. Gidney and Ekerå’s 2019 construction lists Griffiths-Niu among the techniques it combines. In leading factoring architectures the terminal transform is not a dominant resource term.

The cost lives in modular arithmetic. Craig Gidney’s 2025 estimate, which I analyzed when it dropped, puts RSA-2048 at under a million noisy qubits and under a week of runtime on a planar surface-code architecture. Read what drives that number: approximate residue arithmetic borrowed from Chevignard, Fouque and Schrottenloher, yoked surface codes for idle logical qubits, and magic state cultivation to shrink the distillation footprint. Gidney’s headline cost metric is Toffoli count. His longer runtime versus 2019 comes from performing more Toffolis with fewer magic state factories. Webster and colleagues then published the Pinnacle architecture, reaching roughly 98,000 physical qubits with quantum LDPC codes, though that compilation assumes a one-microsecond cycle time and a month of runtime. In March, Cain, Xu, Bluvstein, Preskill and colleagues at Oratomic and Caltech went further with reconfigurable neutral atoms, putting RSA-2048 within reach of 11,000 to 14,000 atomic qubits at very long runtimes, or roughly 102,000 qubits for a projected 97-day run once Toffoli gates are batched in parallel (arXiv:2603.28627). Those estimates rest on radically different hardware models and space-time tradeoffs, and they are architecture projections rather than demonstrations. What they share is where the money goes: arithmetic, error-correcting codes, non-Clifford resource production, decoding, and runtime. None of them gets its headline reduction from Fourier transform compilation.

Map both QFT papers onto my CRQC Quantum Capability Framework and the reading is narrow. They advance B.4, qubit connectivity and routing. They contain no error correction, no logical qubits, no syndrome extraction, no magic state production, no real-time decoding, no long-duration stability, no modular exponentiation. Routing is a real system constraint and my framework treats it as one. It is simply not what is gating the RSA-2048 estimates above.

Set that against what gate-model Shor demonstrations have actually achieved, which remains toy-scale and instance-specific: 15 and 21 are the reference points, and a seven-qubit attempt at 35 failed once accumulated two-qubit gate errors overwhelmed the result. Neither of the experiments discussed here ran a factoring circuit at all.

Unitary gate counts are near a local floor

Here is the forecast I will stand behind, and it comes from reading the two papers against each other.

Q-CTRL claims their LNN compilation removes the CX-count routing penalty entirely, matching the all-to-all baseline. ParityQC claims the iSWAP-based Parity Twine network reaches the asymptotic lower bound for two-qubit gate count on algorithms requiring all-to-all interactions, needing roughly one iSWAP per interaction on a linear chain. These are not the same floor, since they are stated over different native gate sets, and depth, ancilla use, and fault-tolerant spacetime cost all remain open. But for unitary QFT synthesis on a line, measured in two-qubit gate count, both groups are now claiming to be at or near the bottom.

If they are both approximately right, the compiler-driven era of QFT width records is nearly finished, and the candidate successor is already sitting in both bibliographies. Bäumer and colleagues demonstrated a dynamic-circuit QFT in 2024 using mid-circuit measurement and classically controlled corrections, trading two-qubit gates for feedforward. That method applies specifically when the transform is followed immediately by measurement, so it is not a drop-in replacement for a coherent QFT embedded inside a larger algorithm. It is, however, exactly the case the benchmark tests. ParityQC acknowledges that the dynamic approach achieves higher success rates and then rules it out of scope, since their goal is unitary synthesis. Q-CTRL does not pursue it either.

So two teams are competing to optimize unitary compilation, reporting results through an estimator borrowed from the feedforward camp’s own paper, on a benchmark whose terminal-measurement structure is precisely where feedforward wins. My expectation is that the next terminal-QFT width record uses mid-circuit measurement, not a better compiler.

What I’m watching instead

None of this means the work is unimportant. Routing overhead is a real tax on fault-tolerant algorithms, and both papers reduce it in ways that carry into the surface-code era. If you build quantum systems, read them. If you are compiling anything onto near-neighbor hardware, the convolutional kernel idea is worth stealing.

But if you are a CISO reading a headline about a 100-qubit quantum Fourier transform, the things that would actually shift your planning look nothing like this. Logical error rates continuing to fall as code distance grows, at system-relevant scale. Decoders keeping pace with syndrome extraction in real time. Non-Clifford resource production at a cost that stops dominating the spacetime budget. Modular exponentiation demonstrated across logical registers. Fault-tolerant computation sustained for hours, with control and decoding holding up throughout.

When one of those moves, I will write about it in the same tone as this piece and reach a different conclusion. Until then, the reason to migrate has little to do with what was reported here. It has to do with data lifetime, and with deadlines that are already set by regulators, procurement, and your own customers, none of whom are waiting for a qubit count.

The QFT record will fall again. Probably before Christmas.